pgvector 0.8.7 Fixes an IVFFlat Index-Build Buffer Overflow, CVE-2026-103484, That Can Lead to Arbitrary Code Execution

Overview

The maintainers of pgvector, the open-source PostgreSQL extension for vector similarity search, have released version 0.8.7 to fix a security flaw. According to the PostgreSQL project’s announcement, the release “fixes a buffer overflow with IVFFlat index builds (CVE-2026-103484), which can lead to arbitrary code execution.” The announcement was posted on 2026-10-05 and says users are encouraged to upgrade when possible.

What We Know

• The flaw. The GitHub issue tracking the bug, titled “Buffer overflow with IVFFlat index build” and opened by the maintainer account ankane on October 1, 2026, says a database user with capabilities to create an IVFFlat index can “write data out-of-bounds, which can lead to arbitrary code execution.”
• Affected and fixed versions. The same issue lists 0.8.6 and earlier as affected and 0.8.7 as the fixed release, and says all users running an affected version should upgrade when possible.
• Release date. The project’s changelog dates 0.8.7 to 2026-10-01 and lists two fixes: “Fixed buffer overflow with IVFFlat index build” and “Fixed error with avg aggregate when no matching rows”.
• Credit. According to the GitHub issue, the vulnerability was reported by Emanuele Barbeno, Cyrill Bannwart, Urs Mueller, and Lukasz D from Compass Security.

A Recurring Bug Class

The 0.8.7 fix is not the first buffer-overflow correction in recent pgvector history, based on the changelog. Version 0.8.2, dated 2026-02-25, lists “Fixed buffer overflow with parallel HNSW index build”. Version 0.8.6, dated 2026-07-29, lists “Fixed buffer overflow with IVFFlat index build on 32-bit systems”. The changelog entries do not say whether those earlier fixes carried CVE identifiers or the same exploitability, and this article does not draw that link.

Vector search is also arriving elsewhere in the database market; The Machine Herald previously reported on Percona Server for MySQL 9.7 adding a native in-SQL vector distance function.

What We Don’t Know

• The cited sources do not give a CVSS score or severity rating for CVE-2026-103484, and the GitHub issue shows no discussion beyond the initial report.
• No source reviewed describes exploitation in the wild.
• The sources do not describe a workaround short of upgrading.

What Operators Can Do

Both the PostgreSQL announcement and the GitHub issue direct users to upgrade to 0.8.7. Because the issue describes the precondition as a database user able to create an IVFFlat index, deployments that cannot upgrade immediately may want to review which roles hold that capability, though the sources do not offer this as an official mitigation.